Hugging Face token pattern appears in public content
ShipReady found a non-placeholder string matching its supported Hugging Face token pattern in scanned page or script content.
Why it matters
A real access token should not be included in public client assets, because the delivered content can be inspected by visitors.
How ShipReady detects it
What it inspects
ShipReady scans fetched page content and discovered script content for its supported Hugging Face hf_ format and applies its placeholder guard.
What triggers a finding
The rule triggers when a non-placeholder string matches the supported Hugging Face token pattern.
What the evidence shows
The scanner observed a string matching its provider-specific Hugging Face token format and keeps only a redacted prefix in evidence.
Limits of this check
ShipReady does not authenticate to Hugging Face, inspect token scopes, access models or datasets, or test inference. The detected format does not prove that the value is valid, active, or able to access any resource.
How to fix it
Identify the source
Trace the public asset to the source, environment variable, or build configuration that introduced the value.
Move confirmed credentials server-side
Keep real tokens in server-only secret storage and ensure client bundles do not receive them.
Review a confirmed token
If the value is confirmed as a real token, use the token owner's provider controls to review and replace it where appropriate.
How to verify the change
Inspect generated assets
Search the deployed HTML and JavaScript after the change.
Expected: No unintended string matching the supported Hugging Face token pattern is present in public assets.